Experimental quantum key distribution with an untrusted source 
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Abstract 

The photon statistics of a quantum key distribution (QKD) source is crucial for security analysis. 
In this paper, we propose a practical method, with only a beam splitter and photodetector involved, 
to monitor the photon statistics of a QKD source. By implementing in a Plug&Play QKD system, 
we show that the method is highly practical. The final secure key rate is 52 bit/s, comparing to 
78 bit/s when the source is treated as a trusted source. 
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Quantum key distribution (QKD) can establish a secret key between two parties, Alice 
and Bob, by a quantum channel and an authenticated classical channel l|. The uncondi- 

nn 

tional security of QKD has been proven even when imperfect devices are used [2|, y( . 

A QKD system is composed of three parts: source, channel and detection. In the GLLP 
security analysis [2J, the characteristics of these three parts are assumed to be fixed or 
measured and known to Alice and Bob. To guarantee the security of a real QKD experiment, 
one needs to carefully verify these assumptions. 

The decoy state method ^, [f], 0] is proposed to characterize the properties of a QKD 
channel. Since a perfect single photon source is currently not available, an imperfect single 
photon source, such as a weak coherent state source, is used in real QKD setups. These 
imperfect single photon sources may contain some components that are not secure for QKD 
use, e.g., multi-photon state. When Alice and Bob are not able to monitor the channel 
properties, they have to pessimistically assume that all the losses and errors come from the 
single photon components. In this case, the QKD performance is very limited. Fortunately, 
with the decoy states, one can estimate the transmission efficiency of the single photon state 
accurately and improve the QKD performance dramatically. Note that in the security proof 
of decoy state QKD [6|, the photon statistics of the source is assumed to be fixed and known 
to Alice and Bob. The main objective of the paper is to show how to monitor the photon 
source. 

For the detection part, the squash model is assumed in the GLLP security analysis. With 
the squash model, one can assume that Eve, the eavesdropper, always sends a vacuum or 
qubit to Bob. In another word, Bob's measurement is performed on a vacuum or qubit. 



Recently, there are some works done in verifying the squash model 

The third part of the QKD system is the source, which is the main concern of this 
paper. Here, we consider the case that Eve has a full control of the photon source. That 
is, the source is untrusted. This is a crucial assumption in the security proof of some QKD 
schemes, such as the Plug&Play system [ll]. Recently, the QKD with untrusted source is 



studied 
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13]. By random samp 



Eve controls the photon source 



ing the photon source, the security is proved even when 
121 ] . This random sampling process requires a fast random 
switch and a perfect "intensity monitor" . However, in reality, this is not practical. 

In this paper, we replace the random switch with a passive beam splitter. An inefficient 



intensity monitor is used, which is modeled by a virtual beam splitter and an ideal detector. 
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The schematic diagram of the setup for Alice to monitor the photon source is shown in 
Fig. [H In the following discussion, Pi with i — 1, • • • , 6, refers to position i in Fig. [TJ 
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FIG. 1: A schematic diagram of the setup on Alice's side. The untrusted photon source, prepared 
at PI by Eve, passes through a low-bandwidth filter and a phase randomizer (PR). Then a beam 
splitter (BS) (transmission: tbs) is used to separate it into two beams, 3 and 4. One beam goes 
to a photodetector (detection efficiency: tp) at P3 and the other is prepared for QKD at P4. An 
attenuator (Att) between P4 and P5 has the attenuation coefficient rj s (%) for the signal (decoy) 
state. Two polarization beam splitters (PBS1 and PBS2) and a phase modulator (3>a) between 
P5 and P6 are used for phase encoding. 



The experimental procedure goes as follows. 

(i) First, the untrusted photon source passes through a filter, which guarantees the state 
in single mode at P2. Then the global phase of the state is randomized by a phase 
randomizer (PR in Fig. [TJ. Thus, the state at P2 can be expressed as 6| 



P2 



J2Pt(N)\N)(N\, 



(1) 



N=0 



where Pt{N) satisfies Y2 < N=o^ D t{N) = 1 and \N) is the number state. 



(ii) A small part (1 — t^) of the beam at P2 will be reflected by the beam splitter (BS) to 
P4, and the rest of the beam will be transmitted to an inefficient photodetector at P3. 
The inefficient detector can be treated as another virtual beam splitter (transmission: 
to) placed in front of an ideal detector. Thus, the photoelectron distribution D{m) 



measured at P3 is the Bernoulli transformation of the photon distribution Pt(N) at 
P2. On the other hand, Pt{N) can be inferred by the inverse Bernoulli transformation 
of D(m) [14 1 



D(m) = B[P t (N),£] = Pt(N)( N )c(l-0> 

N=m ^ ' 

P t (N) = B-^Dimir 1 } = £ D(m)[ )r N (l - f 1 



Y "" 1 » ' '/.a ( 2 ) 
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m=JV 

where £ = t^tn. When £ > 0.5, the Pt(N) distribution can be efficiently recovered 
from D(m) [lJQ|- 

(iii) From P2 to P4 and P4 to P5, the state will be changed by the BS and an attenuator 
(Att in Fig. [T]) with an attenuation coefficient 1 — £& s and r] s (77^) for signal state (decoy 
state), respectively. Thus, at P5, the photon number distribution P s (i) for the signal 
state is B[P t (N), jf a ] (see Eq. Q2}) and P d (i) = B[P t (N) , r)' d ] for the decoy state, where 
rf 9 = r] s {l - t bs ) and rf d = i] d (l - t bs ). 

D(m) can be measured directly from the experiment. Then Pt{N) can be calculated by 
5q. (|2J). From P t (N), we can bound N G [A^ m i n , A^oa,] with a confidence (1 — e). Following 



12j, one can lower bound the gain Q\ (Qf) and upper bound the error rate e\ (ef) of the 



single photon state. The secure key rate can be written as 



12| 



R = q 



-Q s f(E s )H 2 (E s ) + (l-e)Q s 1 (l-H 2 (ef)) , (3) 



where q is the basic reconciliation factor, Q s and E s are the overall gain and error rate of 
the signal state, f(E s )H 2 (E s ) is the leakage information in the error correction (normally, 
f(E s ) > 1), and H 2 (x) = — xlog 2 x — (1 — x) log 2 (l — x) is the binary entropy function. 

As shown in Fig. [2], we implement the aforementioned scheme in a standard Plug&Play 
QKD system. For applying the weak+vacuum decoy protocol, the experimental parameters 
are listed in Table [B The average photon numbers for the signal state and weak decoy 
state are /1 and is, respectively. N^, N u and A^ are the pulse numbers for the signal, weak 
decoy and vacuum states, respectively. Note that 50 laser pulses are set as a pulse train 
whose period is 350 /is. In Eq. (JH]), one can use q = 0.5F ■ A^/(A^ + N v + No), where 
F = 50pulses/350/is is determined by the burst mode of laser source. The temperature of 
laser diode is well-controlled for decreasing intensity fluctuations. 




FIG. 2: Experimental setup for QKD system. A gain-switched distributed feedback (DFB) laser 
diode emits a pulse train of laser pulses [center wavelength: 1546.1 nm, pulse duration: 300 ps, pulse 
repetition rate: 1 MHz] which are polarized by the polarization maintaining (PM) fiber's slow axis. 
The circulator and 50/50 coupler (CI) are polarization maintained. SPD1, SPD2: single photon 
detector; PBC/PBS: polarization beam combiner /splitter; PMA, PMB: phase modulator; DL: PM 
fiber; Lab'- 25 km single-mode fiber; SL: 5 km storage line; VOA: variable optical attenuator. A 
90° Faraday rotator (FR), together with the PBS, plays the same role as a Faraday mirror. To im- 
plement the aforementioned scheme shown in Fig. [H we use a filter (transparency window: 0.8 nm), 
phase randomizer (PR), 95/5 beam splitter (BS) and pin photodetector (detection efficiency to: 
0.8). 
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rf. 
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f]B 


0.48 


0.06 


0.76 


61747531 


23056601 


5712393 


2.5 x 10~ 8 


3.1 x 10~ 9 


0.04 



TABLE I: The experimental parameters, rjs is the efficiency of Bob's detection system. 



To implement the scheme shown in Fig. [TJ we use a beam splitter (BS) with tb s = 0.95 
transmitting 95% of the laser beam to a pin photodiode. In total, £ = tb s t D = 0.76 of the 
incoming photon source is monitored by the photodiode. In the detection, an integrating 
capacitor is charged by the emitted photoelectrons and its voltage is proportional to the 
number of photoelectrons. The voltage signal is amplified, sent to a sampling oscilloscope 
(Tektronix MSO4104) and recorded. Before next photoelectron pulse arrives, due to the 
charge leakage, the capacitor is discharged. D(m) is experimentally measured and shown in 
Fig. El 

The experimental data are shown in Table [III (m) and (Am 2 ) are the average number 
and variance of photoelectrons m, respectively. From Eq. (j2j), one can derive that (N) = 
1.914 x 10 7 and (AN 2 ) = 1.063 x 10 11 for P t (N), in fact, (m) = £(N) and (Am 2 ) = 
£(1 — £)(iV) + £ 2 (AiV 2 ). Fig. [3] shows that D(m) can be well fit as it is derived from the 
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FIG. 3: (Color online) The photoelectron probability distribution D{m) with the experimental 
data shown as bars. The full curve represents the theoretical fit given that Pt(N) is Gaussian 
distribution. 

Bernoulli transformation of a Gaussian distribution of P t (N). 
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5.84 x 1(T 3 


7.48 x 10" 4 


9.38 x 1(T 5 


2.1% 


46.1% 


1.455 x 10 7 


6.14 x 10 10 



TABLE II: The experimental results. 



In the postprocessing, an improved "Cascade" protocol lTj is applied for the error cor- 
rection and f{E s ) is estimated as 1.06 in Eq. ([3]). Based on the Gaussian distribution of 
P t (N), N e [N min , N max ] with the confidence (1 - e) are chosen as [1.751 x 10 7 , 2.077 x 10 7 ] 
and (1 — 5.7 x 10~ 7 ), respectively. Then follow the analysis proposed in Ref. 12J, Q\ and 
ef are 2.58 x 10~ 3 and 3.77%, and the secure key rate can be calculated as R > 52 bit/s by 
Eq. ([3]). Note that with the same setup, the secure key rate is estimated as R > 78 bit/s if 
the source is trusted. 

We have following remarks: 
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1. Due to the computational complexity of the inverse Bernoulli transformation, see 
Eq. (j2J), we simply assume that Pt{N) follows the Gaussian distribution. As shown in 
Fig. [31 we deduce D(m) from Pt(N) and fit with experimental data. Note that how 
to calculate Eq. ([2]) in postprocessing efficiently is an interesting future topic. 

2. In the experiment, the electronic noise can be deducted from the signal to enhance the 
estimation of D(m). We use an oscilloscope to acquire data from the pin photodetector. 
The data transmission speed of the oscilloscope limits the speed of photon source 
monitoring. In the future, a high speed analog-to-digital circuit can be designed to 
replace the oscilloscope. 

3. In the analysis, we assume that the photon source is single-mode after passing through 
an ideal filter. In the real experiment, the bandwidth of filter is not perfect. Thus, it 
is interesting to investigate how to analyze a multi-mode photon source for QKD in 
future. 



4. Note that the statistical fluctuations from the finite data size |18l . |19| and the accu- 
racy of the estimation of D(m) are not considered in our security analysis, which are 
encouraged to be investigated in future. 

In conclusion, a practical method to monitor the photon statistics of QKD source is 
proposed and is implemented in a real-life Plug&Play QKD system. We run the experiment 
around 20 minutes. The final secure key rate is 52 bit/s, comparing to 78 bit/s when the 
source is treated trusted source. 
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support from the University of Toronto and the NSERC Innovation Platform Quantum 
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